Remove staff only restriction on ajax controller - access control is on entry point (ajax.php) and exposed methods